ci: cut CI cost and contain the Aspire integration-test flake

[Vulthil]

Summary

• Add a per-ref concurrency group to ci.yml (cancel in-progress on PR pushes only) and a per-PR one to claude-code-review.yml.
• Add timeout-minutes to every job in ci.yml, release.yml, docs.yml, claude-code-review.yml, and backport.yml, sized from ~30 days of run history (release.yml's nuget-indexing jobs are budgeted for their documented ~20-25 minute deliberate wait).
• Skip the Opus review job entirely for dependabot PRs (they auto-merge on green regardless of the review) instead of letting the action no-op internally.
• Add a cheap, always-on change-detection job to ci.yml that lets docs-only PRs (docs/** only, README.md changes always excluded) skip the heavy build job via a job-level if:, so the job reports "skipped" rather than never running -- this satisfies a required status check the way a workflow-level paths-ignore cannot.
• Extract a .github/actions/setup-build composite action (setup-dotnet + NuGet cache + dotnet tool restore) shared by ci.yml, release.yml, and docs.yml, giving docs.yml a NuGet cache it never had.
• Split eng/coverage.ps1's test invocation: every project except the Aspire DCP-hosted integration suite runs as before, and that suite now runs separately with Microsoft.Testing.Extensions.Retry's --retry-failed-tests, so a DCP startup flake retries once without any retry-masking risk to the unit suites. Both project sets are derived fresh from dotnet sln list on every run, never hardcoded; leftover generated solutions from a crashed run are gitignored and pre-cleaned.

Verification

• YAML-parsed and structurally checked all touched/created workflow and action files (actionlint unavailable in this environment).
• Ran ./eng/coverage.ps1 end-to-end locally: 1218 tests across the main suite (0 failed) plus 13 tests in the isolated, retry-capable Aspire suite (0 failed, real RabbitMQ container via Docker), then confirmed the merged CoverageReport includes classes from the integration suite's dependencies -- proving the split invocation and coverage merge both work.
• Confirmed a test module without the Retry package reference rejects --retry-failed-tests outright, which is why the flag can't be passed solution-wide.
• Confirmed branch protection is not queryable (404) via the GitHub API, so the docs-only skip uses the required-check-safe job-level-skip pattern rather than a workflow-level path filter.

Backport to v1.0: no — workflow changes apply to the default branch only.